{ "schema_version": "1.6.1", "id": "RPI-CVE-2025-38005", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2025-38005" ], "published": "2025-06-18T09:29:20Z", "summary": "dmaengine: ti: k3-udma: Add missing locking", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: k3-udma: Add missing locking\n\nRecent kernels complain about a missing lock in k3-udma.c when the lock\nvalidator is enabled:\n\n[ 4.128073] WARNING: CPU: 0 PID: 746 at drivers/dma/ti/../virt-dma.h:169 udma_start.isra.0+0x34/0x238\n[ 4.137352] CPU: 0 UID: 0 PID: 746 Comm: kworker/0:3 Not tainted 6.12.9-arm64 #28\n[ 4.144867] Hardware name: pp-v12 (DT)\n[ 4.148648] Workqueue: events udma_check_tx_completion\n[ 4.153841] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 4.160834] pc : udma_start.isra.0+0x34/0x238\n[ 4.165227] lr : udma_start.isra.0+0x30/0x238\n[ 4.169618] sp : ffffffc083cabcf0\n[ 4.172963] x29: ffffffc083cabcf0 x28: 0000000000000000 x27: ffffff800001b005\n[ 4.180167] x26: ffffffc0812f0000 x25: 0000000000000000 x24: 0000000000000000\n[ 4.187370] x23: 0000000000000001 x22: 00000000e21eabe9 x21: ffffff8000fa0670\n[ 4.194571] x20: ffffff8001b6bf00 x19: ffffff8000fa0430 x18: ffffffc083b95030\n[ 4.201773] x17: 0000000000000000 x16: 00000000f0000000 x15: 0000000000000048\n[ 4.208976] x14: 0000000000000048 x13: 0000000000000000 x12: 0000000000000001\n[ 4.216179] x11: ffffffc08151a240 x10: 0000000000003ea1 x9 : ffffffc08046ab68\n[ 4.223381] x8 : ffffffc083cabac0 x7 : ffffffc081df3718 x6 : 0000000000029fc8\n[ 4.230583] x5 : ffffffc0817ee6d8 x4 : 0000000000000bc0 x3 : 0000000000000000\n[ 4.237784] x2 : 0000000000000000 x1 : 00000000001fffff x0 : 0000000000000000\n[ 4.244986] Call trace:\n[ 4.247463] udma_start.isra.0+0x34/0x238\n[ 4.251509] udma_check_tx_completion+0xd0/0xdc\n[ 4.256076] process_one_work+0x244/0x3fc\n[ 4.260129] process_scheduled_works+0x6c/0x74\n[ 4.264610] worker_thread+0x150/0x1dc\n[ 4.268398] kthread+0xd8/0xe8\n[ 4.271492] ret_from_fork+0x10/0x20\n[ 4.275107] irq event stamp: 220\n[ 4.278363] hardirqs last enabled at (219): [] _raw_spin_unlock_irq+0x38/0x50\n[ 4.287183] hardirqs last disabled at (220): [] el1_dbg+0x24/0x50\n[ 4.294879] softirqs last enabled at (182): [] handle_softirqs+0x1c0/0x3cc\n[ 4.303437] softirqs last disabled at (177): [] __do_softirq+0x1c/0x28\n[ 4.311559] ---[ end trace 0000000000000000 ]---\n\nThis commit adds the missing locking.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.47-1+rpt4" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" } ] }, "database_specific": { "per_version": { "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.140", "compiled_filter": false } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2025-38005" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/27e71fa08711e09d81e06a54007b362a5426fd22" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/0ea0433f822ed0549715f7044c9cd1cf132ff7fa" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/df5987e76a4ae4cbd705d81ab4b15ed232250a4a" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/d87f1cddc592387359fde157cc4296556f6403c2" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/26e63b2fe30c61bd25981c6084f67a8af79945d0" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/99df1edf17493cb49a8c01f6bde55c3abb6a2a6c" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/fca280992af8c2fbd511bc43f65abb4a17363f2f" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T12:19:11Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - The k3-udma DMA engine is driven by local device consumers \u2014 a tty (`write()` + `TCFLSH`), ALSA PCM, or SPI node on a TI K3 SoC \u2014 with no network-facing path to the vulnerable worker. Exploitation requires local system access via syscalls/ioctls on those device files.\nAC:L - The attacker controls both sides of the race: the drain-loop side is widened arbitrarily (seconds) by selecting a slow baud rate so the peer PDMA lags, and the terminate side is fired on demand via `tcflush()`, which reaches `dmaengine_terminate_async()` \u2192 `udma_terminate_all()`'s non-synchronous `cancel_delayed_work()`. The sequence is freely repeatable until it lands.\nPR:L - Only an unprivileged account with access to a device node backed by a UDMA channel is needed \u2014 a tty (dialout/owning session), `/dev/snd/pcm*` (audio group), or spidev \u2014 all routinely granted to non-root users on the embedded, industrial, and automotive K3 deployments this driver targets. No capability check gates the path.\nUI:N - The attacker's own `write()`/`ioctl(TCFLSH)` sequence on a device it already has open drives the entire race. No victim action or cooperation is involved.\nS:U - The corruption is confined to kernel heap objects and virt-dma lists within the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unlocked worker dereferences a `struct udma_desc` that `vchan_dma_desc_free_list()`/`udma_purge_desc_work()` may have already `kfree()`d, and traverses spliced list heads \u2014 a use-after-free that lets a groomed replacement object be read back, yielding arbitrary kernel memory disclosure.\nI:H - `list_del()` in `udma_start()` and `list_add_tail()` in `vchan_cookie_complete()` execute unlocked against concurrently spliced and freed nodes, giving classic doubly-linked-list corruption plus writes through a stale descriptor in `udma_decrement_byte_counters()` \u2014 a controllable write primitive suitable for control-flow hijack.\nA:H - Even unweaponized, the use-after-free and list corruption reliably produce oopses, double-frees, and slab corruption panics; the concurrent double `udma_start()` from worker and IRQ handler also wedges the DMA channel." } } }